Splunk Search

How to see if field values from index 1 shows up in index 2?

agoktas
Communicator

Do I need to do some fancy joined search here?

I have values that will show in index 2, and I want to check index 1 to see if they exist, then table results.

Is this something that I need to provide a lot more information on? (i.e.: Log examples)

At least some guidance would be helpful. :slightly_smiling_face:

Thanks!

0 Karma

pradeepkumarg
Influencer

What you are looking for is a sub search. Make sure the field name is same across both the indexes. If not, use the rename command to match the field names

index=myIndex1 [search index=myIndex2 | table myField ]
0 Karma

agoktas
Communicator

Awesome! One last thing...

What if I want to have the dates reflect differently between both indexes?

example:
index 1 = All Time
index 2 = Today

How do I restrict to certain time frames within the search example you provided?

Thanks!

0 Karma

pradeepkumarg
Influencer

You can specify that by using time modifiers earliest and latest

Below example uses 24h for the outer search and 1h for the inner search

index=myIndex1 earliest=-24h latest=now [search index=myIndex2 earliest=-1h latest=now| table myField ]

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/SearchTimeModifiers

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...